Cisco Crosswork Network Controller 7.2.x Administration Guide

Audit logs

Updated: August 14, 2026

Want to summarize with AI?

Provides an entry point to Crosswork Network Controller audit log information and tasks.

The Audit logs section provides audit log concepts, sample audit log entries, common audit log fields and locations, and the task for viewing audit logs in Crosswork Network Controller.

Audit log concepts

Audit logs are records that map user information with all critical user actions performed in the system.

Audit logs capture user actions across these core platform areas:
- User and system administration: device onboarding, user creation/deletion/configuration updates, dashboard customization, show-tech execution, and topology/grouping operations.
- Data and operational management: backup/restore, Crosswork Data Gateway, Inventory (manual sync, enable/disable RI, export, Resync API), and performance policy CRUD and health settings updates.
- Automation and orchestration: Change Automation actions (playbooks, KPIs, KPI Profiles, Alert groups).
- Network optimization and provisioning: Optimization Engine operations (SR-TE, RSVP-TE, affinity mapping, bandwidth functions, RESTCONF operations).
Audit logs capture the source IP for all logged operations. This includes:
- Infrastructure services: TLS certificate operations, app and FP package actions, Placement/Node/Cluster Manager APIs, GEO & Cross-cluster Manager APIs, DLM CRUD actions, performance configuration changes, topology/grouping operations, and dg-manager CRUD (HA pools, custom packages, resource updates, destinations).
- Telemetry and data-collection services: Helios collection job actions, Health Insight API operations, NPM monitoring and data-retention updates, CLMS registration/de-registration/transport settings, and CAT-FP deployment CRUD.
- Provisioning and NSO-routed operations: all CRUD in ZTP (serial numbers, vouchers, profiles, devices), all Image Service operations (with user name and source IP), EMS Inventory APIs, and all NSO JSON-RPC/RESTCONF requests routed through cw-proxy.
Audit logs capture creation of collection jobs and related behaviors, including per-device entries when applicable, and exclude events triggered automatically by internal services.

User actions captured in audit logs

The audit log includes user actions related to these operations:

Device onboarding
User creation, deletion, and configuration updates
Crosswork Data Gateway management operations
Collection job creation
Administrative tasks (show-tech execution, topology updates, NSO-related actions)
Manage playbooks (import, export, delete) and playbook execution, including logs for execution requests, maintenance tasks, execution IDs, and commit labels

Note

When a playbook execution request is sent, Change Automation prints an audit log. The audit log includes details like the playbook name, user information, session details, and the execution ID of the job. When Change Automation executes a playbook maintenance task, it also prints an audit log. The maintenance audit log contains details such as the execution ID. If it performs the commit on NSO, the maintenance audit log details also include the commit label. You can use the audit log to identify all the commit labels associated with an execution ID. Use the commit labels to perform a lookup on the NCS CLI. The lookup shows the exact configuration changes that Change Automation pushed to the device.
KPIs, KPI Profiles, and Alert group creation, deletion, configuration updates, and enabling or disabling of KPI Profiles
Crosswork Optimization Engine operations such as SR-TE and RSVP-TE tunnel management, affinity mapping, bandwidth functions, and RESTCONF operations

Audit log entry examples

Use this topic to look up sample audit log entries and compare the fields recorded for Crosswork Network Controller operations.

Sample audit log entries

This sample log includes source IP, username, and operation details implemented in this release.

2025-10-23T21:03:05.230Z 10.194.126.46 CW[Proxy] 0000019a-12e1-e40e-0000-019a12e1e40e AUDITLOG-CW Proxy-1761253385230-AUDIT_LOG 'CW Proxy -- Attempted commit with transaction id 2 -- N/A --  -- rwonly -- 172.22.227.147'
2025-10-23T21:03:48.516Z 10.194.126.46 AAA 0000019a-12e2-8d24-0000-019a12e28d24 AUDITLOG-AAA-1761253428516-AUDIT_LOG 'AAA -- Login successful -- N/A --  -- localadmin -- 172.22.227.147'

This sample audit log entry is created when a local admin user runs a playbook.


        time="2026-01-09 21:24:31.103312" level=info msg="playbook scheduled for execution" backend=local execution_id=1591737871096-a6699d03-8264-4ea8-8f6f-03e8a58f32a3 latency=11.330355ms loginTime="2026-01-09T20:27:11Z" method=POST playbook="router_config_traffic_steering" policyId=admin set_id=5405fdb1-6b37-41cb-94a3-32b180d3b773 set_name=static-acl-b180d3b773 tag="ROBOT_manager-nca-7689b-fdn8g" user=admin

This is a Crosswork Optimization Engine RESTCONF API audit log entry sample:


        time="2026-01-06 13:49:06,308" message="action=/operations/cisco-crosswork-optimization-engine-sr-policy-operations:sr-policy-delete, input={\"input\": {\"sr-policies\": [{\"head-end\": \"192.168.0.2\", \"end-point\": \"192.168.0.3\", \"color\": 301}]}}, output={\"cisco-crosswork-optimization-engine-sr-policy-operations:output\":{\"results\": [{\"head-end\":\"192.168.0.2\",\"end-point\":\"192.168.0.3\",\"color\":301, \"message\":\"SR policy  not found in Config DB\",\"state\":\"failure\"}]}}" 
          user
         =admin 
          policyId
         =admin 
          backend
         =local 
          loginTime
         =1591451346 
          method
         =POST url=/operations/cisco-crosswork-optimization-engine-sr-policy-operations:sr-policy-delete

Audit log fields and locations

Use this topic to look up audit log field meanings and audit log storage locations.

Common audit log entry fields

Table 1. Common audit log entry fields
Field	Description
time	The time that Crosswork Network Controller created this audit log.
message	Message sent between applications.
msg	Message sent between applications.
user	Name of the user.
policyId	Role or permission of user (taken from local database, TACACS, or LDAP server).
backend	The server (local database, TACACS, or LDAP) authenticating users.
loginTime	The epoch time when the user has logged in. Epoch time is intentionally selected, as it is shorter and independent of time zones.
Other fields	Individual applications use more fields specific to that application. For example: In the sample audit log entry for Cisco Crosswork Change Automation and Health Insights, the playbook field refers to the playbook that Change Automation executed. In the UI audit log entry for Crosswork Optimization Engine, data is a field that refers to the creation details of an SR-TE policy and its attributes.

Audit log location

Crosswork Network Controller stores audit logs in /var/log/audit/audit.log, under the respective application pods. For example:

The sample Change Automation audit log is in the <robot-nca> data directory under the pod.
The RESTCONF API audit log is under the optima-restconf pod.

In addition to the individual application audit logs, Crosswork Network Controller collects all audit log files once each hour. Crosswork Network Controller stores them as separate gzipped tar files in this data directory: /mnt/robot_datafs/<app-name>/<instance>/auditlogs/auditlogs.tar.gz

Crosswork Network Controller collects audit log files based on the specified maximum size and number of backups for each application. For example: MaxSize:20 megabytes and MaxBackups: 5.

View audit logs

The Audit Log window tracks these AAA-related events:

Create, update, and delete users
Create, update, and delete roles
User login activities: login, logout, login failure due to the maximum active session limit, and account lockout due to maximum login failures.
Source IP - IP address of the machine from which the action was performed. This column appears only when you check the Enable source IP for auditing check box and log in to Crosswork Network Controller again. This check box is available in the Source IP section of the Administration > AAA > Settings page.
Password modification by user

Complete these steps to view the audit log:

Procedure

	1.	From the main menu, choose Administration > Audit Log. The Audit Log window opens.
	2.	Click to filter the results by query. Use the export icon to export the log in CSV format. When exporting the CSV, you have the option to use the default file name or enter a unique name.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.